How SORMALITICS Protects Your Financial Data
Encryption at rest and in transit, authentication security, and infrastructure safeguards that keep your data safe.
Financial data requires a higher standard of security than most web applications. SORMALITICS applies multiple layers of protection to ensure your payroll figures, employee records, and invoice data remain confidential and tamper-proof.
All data transmitted between your browser and our servers is encrypted using TLS 1.3. At rest, your data is stored in MongoDB Atlas with AES-256 encryption. Backups are taken nightly and stored in geographically separate regions with the same encryption standard.
Authentication uses JWT tokens stored in HttpOnly, Secure, SameSite=Strict cookies — not localStorage. This means your session token cannot be accessed by JavaScript running on the page, preventing cross-site scripting (XSS) attacks from stealing credentials. Sessions expire after 7 days of inactivity.
We do not store raw payment card numbers. All payment processing is handled by Stripe, which is PCI DSS Level 1 certified. SORMALITICS stores only your Stripe customer ID and subscription metadata. Employee bank account numbers (used for payment file exports) are stored encrypted and only decrypted during export generation.